CVE-2026-40345High▾ MidnightPoC availabledeepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. Prior to 8.0.0, the deepmerge, deepmergeCustom, deepmergeInto, and deepmergeIntoCustom APIs do not track visited objects or object pairs …
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Aug 21.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.6%
1 GitHub repo
Last analysed / modified upstream
deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. Prior to 8.0.0, the deepmerge, deepmergeCustom, deepmergeInto, and deepmergeIntoCustom APIs do not track visited objects or object pairs when recursively merging records. When two input values contain self-references at the same property path, the merge logic repeatedly revisits the same pair until Node.js raises RangeError: Maximum call stack size exceeded. Applications that merge attacker-controlled recursive object graphs can synchronously crash the affected process or cause repeated worker restarts. Plain JSON input alone cannot create the recursive graph required to trigger the issue. This issue is fixed in version 8.0.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
deepmerge-ts < 8.0.0Patched in:
deepmerge-ts 8.0.0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2021-45105Medium· 5.9Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups
CVE-2022-50407Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/qm - increase the memory of local variables Increase the buffer to prevent stack overflow by fuzz test
CVE-2026-93687High· 7.5braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards
CVE-2026-93450High· 7.5go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit
CVE-2026-52852Medium· 6.5Traccar is an open source GPS tracking system
CVE-2026-89418High· 8.7google-protobuf contains an unbounded recursion when parsing unknown protobuf group fields